Avionic system and ground station for aircraft out of route management and alarm communications

ABSTRACT

An avionic system and ground station for aircraft out of route management and alarm communications composed of an avionic device, which is fitted onboard the aircraft, with a memory unit for storing the flight paths data, runways, orography, and obstacles; processors to compute the stored or received data, available from sensors monitoring the onboard situation. Processors will compute commands to be sent to the aircraft&#39;s autopilot to temporarily take over the aircraft control and return it to pre-set flight levels or spatial positions; communication devices suitable for transmitting the real time onboard situation to ground control stations when potentially dangerous events occur.

TECHNICAL FIELD

This invention relates to an avionic system and ground station foraircraft out of route management and alarm communications. Moreparticularly, it relates to a system for handling events in case ofdeviations from the authorized flight paths and from the pre-setaltitude or flight level or spatial limits, and automaticallytransmitting the onboard situation in real time to ground controlstations when potentially dangerous events occur.

BACKGROUND ART

Out of mute aircraft caused particularly serious events, including lossof life. This situation has been traditionally handled by equipping theplane with flight instruments able to display the real time situation tothe pilots and to transmit to ground the security codes entered by thepilots. Given the inadequacy of said means to handle complex situations,the above mentioned avionic system and ground station allows civilaircraft to temporarily operate independently from the pilot, in orderto protect the civilian population. This system allows the aircraft toautomatically react to deviations from the authorized flight paths andfrom the pre-set altitude or flight level or spatial limits, and is ableto convey the exact onboard situation in real time to ground controlstations when potentially dangerous events occur such as pilot errors,particular atmospheric conditions, failures, chaos, hijackings, and soforth.

SUMMARY OF THE INVENTION

It is the main object of this invention to provide an avionic system andground station for aircraft out of mute management and alarmcommunications that Is able to actively control the aircraft route andconvey the onboard situation to ground stations in the event of analarm, effectively increasing aircraft safety and security forpassengers population and residential areas benefit.

It is another object of the invention to provide a system that can beeasily installed and used on aeroplanes, in compliance with commercialaviation regulations.

These objects, and others that shall become readily apparent from thefollowing description, are met according to a first aspect of theinvention, a control function for managing out of route aircraft(collision avoidance) with the features of claim 1 and, in accordancewith another aspect of the invention by means of a method for aircraftout of route management according to claim 9.

The above functions are performed by an avionic device (which will becertified for flight) and are suitable for improving the day-to-dayflight safety, increasing the passengers and the civilian populationsafety. Implementing the solution in accordance with the inventionfollowing targets has significant advantages: maximum possible safetyfor the passengers; real time alarms detection and appropriatereactions; appropriate emergencies handling; automatic events detectionindependently from human intervention; reliable processing of alarmsignals and secure communication with ground control stations;standardized interfaces to allow installation on the greatest possiblenumber of aeroplanes.

The above functions and targets are achieved by means of a systemconsisting of different elements: an avionic device, which carries out“collision avoidance” and “alarm” functions; suitable sensors and onboard transmitters; a ground control station composed by computingsystems. The device is installed in a specific protected housing of theaircraft; it is not accessible and cannot be disabled from the cockpit.

The first function, “collision avoidance”, is performed in the deviceand intervenes temporarily and independently of the pilot as soon as theaircraft deviates from the pre-set flight path, regardless of thecauses. This could occur, for example, if the aircraft flyes in notallowed directions or descends below the altitudes/flight levelsauthorized by the air-traffic control regulations. The second function,“alarm”, is also performed in the device and enables the above mentionedground control stations to receive all the necessary information fromthe aircraft (for example, routes data and images) for carrying outappropriate evaluations when potentially dangerous events occur.

Further advantages of the invention shall be readily apparent from themore detailed description of a particular embodiment of the invention,given as a non-limiting example with reference to the followingaccompanying drawings:

FIGS. 1 and 2 show a schematic diagram of an aircraft that uses thesystem of the invention

FIG. 3 shows a schematic diagram of a runway, which shows approachingaeroplane limits and gives an environment indication related to thesystem of the invention

DESCRIPTION OF A PREFERRED EMBODIMENT

FIG. 1 shows an aircraft that uses the system of the invention. Theauthorized flight path is the upper one; the permissible limits for saidflight path are also shown—if the aircraft descends below these limits,the system automatically intervenes temporarily by making the aircraftclimb to the above said altitude limit and informing the ground controlstations of the alarm condition (FIG. 2).

FIG. 3 shows a schematic diagram of an airport runway. The virtual conesset the spatial limits for containing the flying aircraft—if theaircraft descends below these limits, the system automaticallytemporarily intervenes making the aircraft climb to a defined limitaltitude and informing the ground control stations of the alarmcondition. To maximize safety the system properly considers the landorography, buildings, nearby aircraft, the missing approach volumes andthe authorized circling areas.

The system, in accordance with the invention, is composed by an avionicdevice installed onboard commercial and general aviation aircraft,several sensors and transmitters installed in appropriate points of theaircraft, and connections between said sensors and the avionic device.The system exchanges information with ground control stationsspecifically designed to handle the data transmitted from the aircraftand to perform secure communication with the avionic device.

The avionic device comprises CPU (Central Processor Unit) suitable forhandling all the data at the required processing speed, specificsoftware, electronic components; it has memory devices suitable forstoring the world flight paths data and relevant limits, the world'sairports positions and relevant limits, any other required data; inputand output interfaces suitable for exchanging the required informationand data between the aircraft, other nearby aircrafts and the groundcontrol stations.

The “collision avoidance” function, which is one of the functionscarried out by the avionic device, is not only used to avoid collisionswhen the aircraft is flying, but also during landing and take-off. Whencontrolling the aircraft route, the unit operates based on the globalauthorized minimum cruising altitudes and flight levels, the so-called“limits”, covering every area of the globe, always in compliance withall the civil aviation regulations, including the ICAO ones. As a nonlimiting example, when the aircraft is out of route or descends belowthe said limits (see FIG. 1), the unit automatically temporarilyintervenes through appropriate connections with the unit itself, theautopilot and the navigation system.

During take-off and landing, the unit operates by creating virtual conesthat delimit air space and considering the land orography, the flyingand ground obstacles, and all other data of interest (as shownschematically in FIG. 3); these data for every area of the globe arestored in the storage unit of the system as necessary. The “collisionavoidance” function is carried out through two states. In the firststate, the so-called “monitoring state”, the unit constantly comparesthe position of the aircraft with the pre-set and stored authorizedlimits. The unit continuously receive the data through its interfacingwith the navigation system of the aircraft and its sensors. The limitsdepend on the flight areas, the applicable regulations, the man-builtconstructions, obstacles and many other factors. For example, the storeddata includes the coordinates of all the world's airports and all thelanding and take-off procedures established in compliance with the ICAOregulations. All the necessary information is kept up to date in realtime, so that any changes to the above parameters are considered whencompetent authorities or aeronautical bodies change it, and this isaccomplished through appropriate automatic updating procedures performedconnecting the unit to ground control stations through data links (linksdescribed in the alarm function).

In the second state, the so-called “control state”, when the aircraftdeviates from the authorized limits the unit intervenes automatically onthe autopilot, through the aforementioned interfaces, to take theaircraft to its spatial limit.

The preferred version of the aircraft out of route management system isas follows: in the monitoring state, it allows all the aircraft flyingat altitudes or flight levels higher than the pre-set limit (establishedby the ICAO regulations for the different flight paths) to stay underthe direct pilot control, also allowing flight path changes above thelimit altitude or flight level (alarms will be generated only in case ofbig flight path changes). The transition to the control state onlyoccurs if the aircraft leaves its route to fly in unauthorizeddirections or descend below the preset limit. In this case, the unittemporarily takes control of the aircraft, through the collisionavoidance function, to make the aircraft climb to the pre-set limit.Once the safety limits have been restored, the system gives the controlback to the pilot.

The preferred version of the collision avoidance function during landingand take-off is as follows: for each airport two virtual cones (one inthe landing direction and one in the take-off direction) are designedvia software, in compliance with the instrument approach procedure, themissed approach procedure and virtual circling areas for the concernedrunways. When the aircraft is involved in landing or take-off phases,the unit may also command the autopilot and temporarily take the controlof the aircraft to place it in a predetermined position at a safetyheight. For example, this can occur in the following cases:

If during the approach procedure in the landing cone the aircraftsuddenly flies below the cone limits (alarms will be generated if itflies out the cone above the limits);

If the aircraft flies at a speed considered incompatible with thelanding and missed approach procedures;

If during climbing or after flying over the runway, the aircraftsuddenly flies below the cone limits (alarms will be generated if itflyes out the cone above the limits).

The collision avoidance function is constantly able to compute theoptimal climbing flight path and speed to avoid crashing to a ground orair obstacle. It accomplishes this by using its and other aircraft speedand position, the protection areas, the orography of the land, theartificial obstacles placed near airports, and any other requiredinformation available on board through the a.m. interfaces.

Additionally other interfaces are foreseen in unit; interfaces withsensors to receive row signals in order to calculate automatically anindependent present position, interfaces with the navigation system toget the present position signals already computed by other equipment inorder to check the accuracy of the data.

The collision avoidance system may be optionally doubled to make thesystem even more reliable.

The second main function carried out by the avionic device, theso-called “alarm function”, is to allow communication between theaircraft and ground control stations or other aircraft. The “alarmfunction” function is also carried out through two states.

The first, the so-called “monitoring state”, consists in collectinginformation on the aircraft onboard situation and storing it in thememory unit. This information is not automatically transmitted to theground control stations. In the second state, the so-called “alarmstate”, which is activated in cases of alarm, the unit transmits theinformation generated onboard the aircraft to the ground controlstations for appropriate evaluation.

To carry out the alarm function, in addition to the avionic unitdescribed above, it is required to install on board additional devices,such as miniature surveillance video cameras, miniature transmittersthat can be worn by the flight crew, switches, cockpit locking systems,specific interfaces, and an appropriate communications system. Suitableground control stations complete the system. Other devices may also beconnected when required by regulations or airline specifications.

A preferred description of the process carried out by the avionic unitto fulfil the alarm function is given below. In the monitoring state,the avionic unit has a “surveillance” role and constantly communicateswith the video cameras and sensors onboard the aircraft. It records theimages and the required information at pre-determined time intervals,and stores the information and data for a pre-determined amount of time.In this state, through interfaces with the collision avoidance function,the unit constantly compares the position of the aircraft with theexpected route in the flight plan; furthermore, the unit continuouslyautomatically checks its functions. The system enters the pre-alarmstate if a hijacking or terrorist act is detected by the sensors or theflight crew, if there is a significant deviation from the flight plan orif the cones areas are not respected. In this state, a validationrequest is sent to the nearest ground control station. If this is notvalidated within the predetermined time interval by the ground controlstation, the unit will automatically pass from the monitoring state tothe alarm state. It goes directly in alarm state if the aircraft fliesbelow the a.m. flight limits.

In the alarm state, the unit constantly transmits the aircraftnavigation data and other data (for example, images) to ground controlstations, and receives messages to the flight crew and passengers. Bothin the monitoring and in the alarm state, the unit works independentlyof the pilot and, in the event of attested terrorist events, itautomatically communicates any necessary data to the ground controlstations. Appropriate measures will be implemented so that, even in thecase of mechanical damage to the onboard instruments or wiring, the unitis not affected.

The unit have its interfaces with the onboard systems and with theaircraft communications system in order to communicate all the necessarydata with the ground control stations.

The system comprises a number of miniature surveillance video cameras,which are installed in appropriate positions depending on the size ofthe aircraft and are wired to the alarm unit. During the monitoringstate, the video cameras automatically send a signal if they have beendisabled, damaged, or covered. The video cameras transmit the imagesconstantly both to the cockpit and to the unit.

The system comprises several sensors appropriately connected to thealarm unit installed in the aeroplane in appropriate positions dependingon the size of the aircraft. Preferred sensors are “radio controlled”crew wearable miniature transmitters that can be operated with switches.These are “radio controlled” heart rate monitors for the pilots,switches on board usable by the flight crew. The flight crew maymanually activate the sensors, sending different impulses to the avionicunit in the event of hijacking or a terrorist act; these transmittersare equipped with switches and have specific protective mechanisms toprotect against false alarms. Furthermore, switches are located inplaces that may be accessed by the passengers as well. Optionally, incase of alarm the unit could automatically lock access to the cockpit.

The system is completed with suitable ground control stations.Preferably, these do not receive information during the monitoring stateof the unit. In the pre-alarm state or when the alarm state isconfirmed, the ground control stations receive, from the concernedaircraft flying in their range, both the information registered beforethe alarm event and real time information from the aircraft. The groundcontrol stations will perform the following preferred procedure: providethe received information to the competent authorities; continuouslycheck the correctness of the flight parameters of the aeroplanes undertheir control when in the pre-alarm state and alarm state; constantlycheck the aeroplane onboard situation during hijacking and promptlyrelay the needed information. An adequate number of ground controlstations will be located for the proper management of the system in thelocations deemed necessary by the national authorities. The stationswill include at least the following systems: adequately powerfulcomputers with specifications suitable for the functions to beperformed, a receiver-transmitter radio system, an encryption and codingsystem, an audio-visual-data communications system. Theonboard/ground/onboard transmission of the information will be performedpreferably through a data link connection managing audio, data radar andvideo signals and featuring an encryption and coding system capable toprovide high resistance to jamming. Transmitted data will be sent with asuitable data format on appropriate transmission frequencies and withadequate waveforms. Spread spectrum techniques (Frequency Hopping orDirect Sequency) will be also considered to improve the quality,security, and reliability of the transmission and to avoid interferencewith other radio transmissions.

To avoid possible collisions with other aeroplanes in the collisionavoidance function (or in the alarm state) when the autopilot isbringing the aircraft to the pre-set spatial position at a certainaltitude or flight level, the system will be provided with the nearbyaircraft position. For example, to accomplish this, the unit may receiveinformation coming from General Aviation systems such as the AutomaticDependent Surveillance (ADS) system, which is able to transmit theaircraft position via radio link, or can receive data detected by groundradars, which will transmit them to the concerned aircraft in the mostappropriate way (exemple, through the a.m. ground control station).

To increase connectivity and minimize the number of ground controlstations, the system may also operate through a specific satellite WideBand Data Link connection. This will allow the aircraft to be monitoredwhen flying over open oceans and improve the transmission of images interms of speed and size, which could be very slow if a radio band isused.

Optionally, appropriate measures may be implemented in the unit toelectronically scan the on board images (for example, to automaticallydetect the presence of firearms). Optionally, narcotic or poisonous gasdetectors may be installed on board.

The system also provides a function for handling the emergencies. Thisconsiders both the possibility that the system may be disabled under thethreat of arms and the need for the pilot to immediately intervene inthe critical phases of a real emergency. To achieve the first objectivethe system always works automatically, and cannot be disabled by thepilot. In case of alarm the system sends messages, incuding diablingcodes. The use of secure radio bands guarantees a secure connection withthe ground control stations and makes it possible for the aircraft tosend automatically, if the alarm event is triggered, standard messagesthat inform the competent authorities of the onboard situation and toreceive any disabling signals from ground. For this reason it ispossible to confirm the disabling of the entire system from a groundcontrol station or from another aircraft after checking the receivedmessages (example images). This covers the risk that the system may beshut down by accident, by “expert” telecommunications terrorists, orunder threat of weapons.

To achieve the second objective, necessary to automatically disable thesystem through the avionic unit. A list of possible oftechnical-operational-structural serious emergencies to be stored in theunit (for example, engine failure) must be prepared. Real signals needto be received by the unit through specific interfaces with the onboardsystems. When these emergencies occur, a specific software willimmediately react, giving complete control to the pilot. The unit willthen start communicating to the ground station, sending the stored andreal time data and asking for confirmation of the disabling code. Incase of confirmation the unit automatically disables.

Thanks to the above characteristics and functions, the system of theinvention provides real time information on the situation onboard theaeroplane and allows the aircraft to fly below the limit altitude orflight level only for taking off or landing, preventing the aircraftfrom descending to any point of the globe unless there is a realemergency on board. Thus, the system is able to manage an aircraft outof route, increasing the flight safety, providing to ground, throughsecure communication, the onboard situation in real time. In addition,the system increases the day-to-day flight safety since it provides anautomatic service that prevents the aircraft from descending, even inthe event of an error, below the minimum height established by theregulations, avoiding possible accidents due to human and orenvironmental factors.

The system, thanks to the interfaces with the onboard systems, canoptionally take the aircraft to an autonomous landing, depending on theaircraft and airport equpment configuration.

1-11. (canceled)
 12. An avionic system for aircraft out of routemanagement and alarm communications comprising: at least an avionicunit, located onboard an aircraft, provided with: a memory unit forstoring predefined information, electronic processing means forprocessing the received information and comparing it in real time withpredefined values, interfaces for receiving information from onboardsystems and sending commands to an aircraft's autopilot to take over thecontrol of the aircraft and return it to predefined flight levels orspatial positions, suitable sensors for obtaining data on the aircraftonboard situation, communication system for transmitting the onboardsituation in real time to a ground control station and receive from theground control station, or from another aircraft, appropriateinstructions when predetermined events occur, wherein the avionic unitis able to perform a collision avoidance function, to avoid collisionsduring aircraft flight, landing and take-off, wherein the collisionavoidance function defines a monitoring stage, during which the avionicunit constantly compares the position of the aircraft with predefinedand stored authorized limits, and a control stage, during which, if theaircraft deviates from the authorized limits, the avionic systemintervenes automatically on the autopilot, through said interfaces, tobring back the aircraft within its spatial limit, and wherein theavionic unit is able to perform an alarm function, wherein the alarmfunction defines a first, monitoring stage, during which information onthe situation onboard the aircraft is stored in the memory unit and isnot automatically transmitted to the ground control stations, and asecond alarm stage which is activated in cases of alarm, during whichthe information generated onboard the aircraft by the avionic unit istransmitted to the ground control stations for appropriate evaluation.13. An avionic system according to claim 12, wherein said informationrelates to flight paths, world's runways, orography of the land,obstacles and the predefined values comprise flight paths and altitudesor flight levels.
 14. An avionic system according to claim 13, whereinwhere the aircraft sensors comprise surveillance video cameras andminiature transmitters, wearable by the flight crew, in order to obtaininformation for the avionic unit.
 15. An avionic system according toclaim 14, wherein the video cameras comprise means for establishingwhether they have been disabled, damaged, or are malfunctioning.
 16. Anavionic system according to claim 15, wherein the sensors comprise heartrate monitors for the pilots to be connected to the avionic unit.
 17. Anavionic system as claimed in claim 16, comprising means for encryptingand coding the signals exchanged between the aircraft and the groundcontrol station not interfering with the radio band communications. 18.An avionic system according to claim 15 comprising switches located inspecific points of the aircraft available to crew and passengers toobtain information for the avionic unit, and a cockpit automatic lockingsystem.
 19. An avionic system as claimed in claim 18, comprising meansfor encrypting and coding the signals exchanged between the aircraft andthe ground control station not interfering with the radio bandcommunications.
 20. An avionic system according to claim 15 comprising,in the event of an emergency, means suitable for externally and/orautomatically disabling the collision avoidance system in accordance topredefined rules.
 21. An avionic system as claimed in claim 20,comprising means for encrypting and coding the signals exchanged betweenthe aircraft and the ground control station not interfering with theradio band communications.
 22. A ground control station suitable forinterfacing with an avionic system comprising at least an avionicdevice, placed onboard an aircraft, with a memory unit, electronicprocessing means, interfaces, sensors, communication system, wherein theavionic device is able to perform a collision avoidance function and analarm function, the ground control station comprising: at least acomputer for processing data received from said avionic system; atransmission-reception radio system; an encrypting and/or coding system;and an audio-visual communications system; and wherein the groundcontrol station comprises means for carrying out a collision avoidancefunction, to avoid collisions during aircraft flight, landing andtake-off, the collision avoidance function defining a monitoring stage,during which the unit constantly compares the position of the aircraftwith predefined and stored authorized limits and a control stage, duringwhich if the aircraft deviates from the authorized limits the unitintervenes automatically on the autopilot, through said interfaces, totake back the aircraft to its spatial limit, and wherein the groundcontrol station comprises alarm means for carrying out an alarmfunction, wherein the alarm function defines a monitoring stage, duringwhich information on the situation onboard the aircraft is stored in thememory unit and are not automatically transmitted to the ground controlstations, and an alarm stage which is activated in cases of alarm,during which information generated onboard the aircraft by the avionicunit are transmitted the to the ground control stations for appropriateevaluation.
 23. A method for aircraft out of route management whereinthere are provided an avionic system comprising at least an avionicunit, fitted onboard an aircraft, with a memory unit, electronicprocessing means, interfaces, sensors, communication system, wherein theavionic unit is able to perform a collision avoidance function and analarm function, and a ground station comprising at least a computer, atransmission-reception radio system, an encrypting and/or coding system,an audio-visual communications system and means for carrying out acollision avoidance and an alarm function, the method comprising thefollowing steps: defining first data for a collision avoidance functionand loading said data into the avionic unit; defining second data for analarm function and loading said data into the avionic unit; definingthird data for at least one ground control station and loading said datainto the station; defining interfaces; defining communication channelsand their respective properties; defining sensors, transmitters,switches, and video cameras; determining operating logics of thecollision avoidance function and their implementation in the avionicunit; determining operating logics of the alarm function and theirimplementation in the avionic unit; determining operating logics of theground control station and loading them into the station; comparing theposition of the aircraft constantly with predefined and storedauthorized limits intervening automatically on the autopilot to take theaircraft to its spatial limit through the interfaces when the aircraftdeviates from the authorized limits storing the situation of theaircraft onboard in the memory unit and not automatically transmittingto the ground control stations; and transmitting said informationgenerated onboard to the ground control stations for appropriateevaluation when a second alarm state is activated in cases of alarm. 24.Method according to claim 23 wherein the electronic processing meansprocess receive information and compare it in real time with datareferring to predefined flight paths and allowed altitudes or flightlevels, and wherein the interfaces receive flight information fromonboard systems and send commands to the aircraft's autopilot to takeover the control of the aircraft and bring it back to predefinedaltitudes or flight levels or spatial positions, and wherein sensorsobtain data on the situation onboard the aircraft, and wherein thecommunication means and the connecting interfaces transmit informationrelating to onboard situation in real time to ground control stationsand receive appropriate instructions from the ground control station orfrom another aircraft when predetermined events occur.